GV-2.1 Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization
Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization. Duties for mapping, measuring
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the assignment was communicated and acknowledged by role holders · Identity provider / directory
governing documentDocuments that govern the control
- A responsibility assignment covering the map, measure and manage duties · Document repository
- Organisational chart or charter showing the reporting line for AI risk functions · Policy repository / GRC workspace
- Escalation paths with named recipients and thresholds · Document repository
First move
Common gaps auditors find
- Responsibility assigned to a committee rather than to a person who can be asked
- Test and evaluation reporting into the same manager who owns the delivery deadline
- Assignment current at the last reorganisation rather than at the present one
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV-1.7 Processes and procedures are in place for decommissioning and phasing out of AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness · GV-2.2 The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements